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MEMORANDUM FOR: Director of Security 


PROM Clifford D. May, Jr. 


Director of Data Processing  25x1 


ee 


SUBJECT - : Computerized Database ~- Areas Approved £ 
Storage of Collateral and SCI material] | 
REFERENCES : a. Meno to D/ODP fm D/OS dtd 27 Jan. 77, 
j same subject. 
b. Memo to D/OS im D/ODP dtd 25 Feb. 77, 
same subject. 


25X11 e othee [eee Me previous imemorandum (reference b.) stated 
that dun as the earliest date that ODP would have | 
personnel available to work on your request. However, an 
analyst from B Division of Applications is now available to 
bagin work on this project. Chief, B25X1A 
Division, has contacted of the Special “OBX1A 
Security Center to begin a preliminary study of your require- 


ments. 

25X1 2.[__ After analyzing the requirements of the proposed 
Storage Facilities system we have concluded that we could 
readily implement it using ODP's central compute Yrs. However, 


a significant resourca commitment is required to collect thse 
necessary data and enter it into the data base. We have pre- 
pared an analysis of the data collection and preparation tasks 
and recommended procedures to obtain the data necessary for 
the system. ‘These are contained in the attached study. 


25X1 3... | Because there is a significant resource commit- 
ment required of Security, ODP, and other Agency components, 
25X1A I recommend that[__————CédiS COCinatte the review of this 


study with those people identified in paragraph 1. of the 
attachment. Before you and I approve ODP's continuing with 
the oP des development, we should be certain that we agree 
with the findings and recommendations of the attached study. 
Tf you concur with the study's roacommendations and want ODP 

to continue work on the schedule provided in the study, please 
sign below. 
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or your staff have any questions concernina this ect, 


Att: a/s 
CONCUR: 
Director of Security Date 


ce: C/BD/ODP 
C/AS/ODP 
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SYORAGE FACILITIES DATA BASE 


(STORFAC) STUDY REPORT 


Storage Facility Data Bas eon 


References: (1) Memo a CD/ODP, dtd 16 Nov 725X1A 
subject: Requirements asd | for 


(2) Memo fr Chief, Compartmented Information 
Branch, DD/PEM/0S, dtd 15 Jan 77, subject: 


Top Level Re nts for Storage Facility 25x1 
Data Base 


29X1 1.[ _ \gency personnel. who have an interest in the 
Storage Facilities Data Base Concept presented in References 


l and 2, met during the month of December 1977. The fo Ollowing 


inidividuals were present: 


25X1A C/CIB/SSC/OS 
TSB/PSD/OS 
OD&E Security Staff 
OD&E Security Staff 
OL Security Staff 
C/BD/ODP 
CD/ODP 
C/SMS/DDS&T 
NFAC Security Staff 
CSD/QC 
C/ISSG/OS 


The references had been studied prior to the meeting. The 
data base concept was thoroughly discusseaé. The final outcome 
of the meeting was a general concurrence that such a system 

is needed, general agreement on the types of data which should 


be collected and maintained, and satisfaction with the fornats 
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and frequencies of the reports which should be produced. The data 


elements which would be needed to support the system are listed 
in Reference Ls Report formats are detailed in Reference 2. 
25X1 2. [ _] the general consensus was that a system was 
needed to inventory and monitor secure storage facilities. 
It was questioned, however, whether the development should 
proceed at this time, since the Agency is currently pee cornine 
other studies related to industrial security practices. It 
was decided that ODP shoud expend sufficient effort to investi- 
gate the following: 
® Where is all the data which is needed for data 
base generation currently located? 
° How can this information be gathered and reduced 
to machine readable format? 
° What input media should be used (cards, CAMEXEC, 
etc)? 
° What are the STORFAC development costs? 
° How, Long will it take to develop such a system? 
The paragraphs which follow address these questions and con- 
tain the findings of this short study effort. 
25X1 3 = Data which is needed to generate a Storage 
Facilities file is stored in several offices at various loca- 


tions. Some of the data sources will be relatively easy 
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to research. Some of the data is stored in voluminous 
tsldoes and will require considerable effort and some source 
familiarity in order to extract the required information. 
The primary offices which currently maintain most of the 
required information are: 
| - Office of Security (0S) 
~ Special Security Center (SSC) 
- Information Systems Security Group (ISSG) 
- Physical Security Division (PSD) 
-~ Industrial Security Branch (ISB) _—, 
- Overseas Security Branch (OSSB) 
- Domestic Security Branch (DSB) 
- Technical Security Division (Tsp) 
~ Office of Logistics (OL), Security Staf€F a 
~ Office of Communications (OC) _— 
25X1A 
-~ Communications Security Division (CSD) 
fo 
Additional data sources may be identified as the development 
effort progresses. 
4{|nformation On approximately 1,200 active storage. 


locations is maintained in @SC) This information is logged 


and maintained on manual records (5 x 7 index cards). Each ~ 
card contains data for one location. Data values on the 
index cards are labeled and, therefore, would be relatively 


easy to extract. ‘The following information is normally 
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available on each facility index card: 


Facility Name 

Activity Indicator 

Facility Location 

Cover 

SPECLE Number (assigned by SSC) 

Agency Interest’ 

Security Officer w/telephone number 

Alternate Security Office w/telephone number 
Responsible Agency, Component, Division, Contract Team 
Type of Operation ei" 
Facility Clearance Level 
Accreditation Date 
Special Activities 
Associated SCI Projects 
Comments 


5{ enon Security Staff) maintains approximately 


1,900 contract folders. About 600 of these folders are main- 


° e900 0 GO GO oO eo eC oO eo 6 


_ tained for active contracts/contractors. The folders contain 


all the information concerning the contract that a vendor has 
withthe Agency. In addition, the folder has information 
regarding the contractor facility in which classified informa 
tion is stored and/or produced. These folders are for facili- 
ties which may or may not be the same as those facility index 
cards maintained by SSC. Detailed examination of these folders 
would normally yield the following data items: 

Pacility Name 

Facility Location 

Clearance Level 

Sterility Code 

Security Officer w/telephone number 

Alternate Security Officer w/telephone number 


Security Survey Date(s) 
Component/Division/Team Responsible for the Facility 


ooc.o 09 0 806 6 Oo 


Extraction of the data from the OL Security Staff contract 
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the researcher had a Limited familiarity with the contents of 
the folder. This is primarily due to the quantity of data 
stored for a particular contract. 

6. [ The(OS/PSD) maintains folders on approximately 
[_Jactive stations located around the world. Information for 
‘most of the facilities (stations) maintained by PSD is also 
located on the 5 x 7 index cards kept by SSC. In addition to 
‘data which describes and locates a station, the folders 
identify storage type, cover and type of operation. Also, 
they specify the historical security survey and security sian: 
dates which are required for development of STORFAC. These 
‘folders contain a considerable volume of data and would require 
some degree of familiarity with the contents in order to re- 

search and retrieve the necessary historical information. 


71 | tne oc, CSD and[___s po fficersmaintain data 25X1A 


for installations on which a COMSEC or TEMPEST survey is to 
be or has been conducted. Information on COMSFC and TEMPEST 25X1A 
surveys is maintained and readily accessible in CSD and[ | 
on chronological lists which identify the facility and specify 
the latest survey dates. 

: g.[ i jos/isse maintains a data file which contains 
records on approximately[ _|computer facilities. These 


computer areas are primarily located at contractor facilities. 


Information in this data file consists of the following: 
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Facility Name 

Facility Location 

Clearance Level - 

Responsible Component/Diviston/etc. 

Date of latest computer Facility Inspection 
Identification of the types of Computing Equipment 
w/vendor 


oo .G9 8 8 8 


This data is processed periodically to produce tabular reports 


in several different sequences (Location, Pacility Name, etc.). 


It would be relatively easy to research and extract data for 


inclusion in the STORFAC data base. 


Se [ _ rsp Maintains information concerning the 
dates on which an ACM survey was conducted at a specific facility. 
This information is readily available for extraction and 


inclusion in the STORFAC data base. 


order to develop the STORFAC data base is how to collect, 

edit, collate, and enter the information which is available 

at the various sources. A procedure must be developed which 
will either (1) allow all available data to be collected, 
éaraated and edited for each unique facility prior to intro- 
duction to the data base; or (2) allow for incremental develop- 
ment. After considering both approaches, it is suggested 

that the second approach be considered for the development 
effort. An incremental approach would allow for development 

of a partial data base which would contain partially complete 
records. Subsequent operations would supply additional facili- 


ties not currently included in the SSC files and provide the 
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25X1 


ike completed 
records complete. Figure l, pages 1 through 7 is a flow 
diagram of the suggested approach. 

ui.[ _hny attempt to assemble all the necessary infor- 
mation prior to data base generation would require a signifi- 
cant redundant effort to code information at the various data 
source locations. In addition, it would place a tremendous 
burden upon SSC to collate all the data for a unique. facility 


prior to its introduction to the data base. 
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Apardved For Rplease 2pnaosiien cla ROR eBat I TPMi0086H200075111.< begin 
in the SSC of the Office of Security. Data from each of the 
1,200 index cards would be examined. Data eens required in 
the STORFAC data base which are available in SSC would he 
entered on a Delta Data terminal using a CAMBXEC menu. Figure 
2 is a copy of the menu which identifies those data items 
input by SSC. Edit routines would be invoked, where applicable, 
to ensure that the data entered conformed to acceptable formats, 
ranges and values prescribed by ssc. After the data passes 
the applicable edits, it will be stored in a transaction disk 
file. Periodically (perhaps once or twice a week), the trans- 


action data would be batched into a job stream which would 


invoke the File Maintenance (FM) module of NIPS. This trans- 


action information would be used to generate (first time) or 
add to the STORFAC data base. 

13. [ J After each FM process, SSC would be provided 
with an audit trail report which would consist of a formatted 
dump of the content of each STORFAC facility record which was 
added to the file or enwnaed in any way during the FM run. 
This activity would continue until data from all 1,200 index 
cards had been extracted and entered into the file. At this 
point in time, a partially complete STORPAC data base would 
be available for processing by SSC. However, this file would 
only contain partially completed data records. The other 
information needed to make each facility record complcte re- 
sides in the other offices identified in paragraph 1 of this 


report. 
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25X11 7 14. In order to continue the incremental develop- 


ment effort, the data wen Tanne in the STORFAC data base would 
be extracted, sorted ana processed to produce a master report 
similar in appearance to the CAMEXEC menu used for data intro- 
duction. The sequence of this report would be in facility 
name order. Only data for one facility would appear on each 
printed page of the report. At the same time, one line per 

facility cross index listings would be produced to assist 
the other offices who will be contributing data in their 
facility research and identification activities. The cross 
indices could be provided in facility location by State, 
SPECLE Number, etc. orders, as considered necessary for 
identification purposes. ‘The master report fora would con- 
tain all of the known (previously entered by SSC) data together 
with sufficiently labeled space for that information not 

| currently in the data base. 
25X1 | -15. [| A quantity of blank founs similar to the. 
CAMEXEC menu would he produced for use by the offices other 
than SSC, to enter data for facilities not currently resident 
in the STORFAC data base. These forms would have space for 
all the required data fields with labels for data entry. 
25X11 : is. | The master report, cross index reports and 
: “a supply of blank menu forms would then be forwarded to the 


OL Security Staff for their inputs. 


Li? 
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must be researched in OL. Lf the folder is for a facility 


already in the STORFAC data base, additional items of infornma-~ 
tion (dates, etc.) must be extracted and entered in the appro- 
priate space on the partially complete master report page for 


that facility. If the folder is for a facility not currently 


in the STORFAC data base, one of the blank forms must be com- 


pleted. All applicable data in the folder muee Be extracted 
and entered. Figure 3 identifies those data values which 
would be supplied by the OL Security Staff folder research 
Bpiore: 

us.[ | When all 600 contract folders have been 
researched, the partially completed forms, the blank menus 
and the cross index listings will be forwarded to Physical 
Security. The records in PSD would be researched, data ex- 
tracted and entered on the forms in (is same manner as the 
process accomplished in OL. (Figure 4 identifies those data 
values which would be supplied by the PSD folder research 
effort.) When all PS facility records have been exhausted, 
the forms and index reports will be forwarded to TSD where the 
process is repeated (Supply ACM dates Pas eeieeune STORTAC 
records, create new forms for previously not identified facili- 


ties.). When the TSD activity has been completed, the entire 


package will be passed to ISSG for their data extraction process. 


When the ISSG extraction effort is finished, the package is 


18 
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is repeated. When deiplees, OC Witt return the entire package 
to SSC. (Pigure 5 identifies those data values which would be 
supplied by TSD; Figure 6 identifies those data values supplied 
by ISSG; and Figure 7 identifies the data values supplied by 
oc/csp and[___ 

19. [ Upon receipt of the package from OC, the final 
stage of incremental development can begin. Each facility form 
must be examined to determine if it is a new facility (not as 
of the original 1,200 SSC records) or if it is one of the 
original SSC facilities. If it is a form for a new facility, 
SSC must determine its SPECLE Number and assign a machine 
reference number (MRN). Since the MRN is the record control 
element for STORFAC, care must be exercised to ensure that 
this MRN is unique from all others. When these two data 
fields have been completed, the information can be entered via. 
the CAMEXEC menu and transactions created and stored on tnd 
transaction file. 

20. | ts the form is for one of the original 1,200 
facilities, the data added by OL, PSD, ISSG, TSD, and OC would 
be entered via the CAMEXEC menu and stored with the eeansacerene 


produced in the previous step. When all information has been 


entered, the transaction data would be batched into an FM job 


stream and the STORFAC file updated. At this point, SSC should 
be in control of a complete Storage Facilities Data Base. It 


is suggested that Master Format Reports be produced for each 


21 e.g 
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new facilities identified and errors found in the data base, 
blank forms similar to the CAMEXEC menu can be used to forward 


new or changing information to SSC for inclusion in the data 


base. 


A =| The previous paragraphs briefly describe a 
suggested process which could be used to incrementally develop 
the STORFAC data base. The pages which follow estimate the 
costs for this effort. Costs are identified for Agency re- 
search and entry sitar’ in working days, software development 
in working days and machine costs in terms of computer esate 
and terminal hook-up costs. | 

22. [ _| the cost for the ongoing File Maintenance 
activities which will be requirea to keep STORFAC current are 
difficult to determine. It is estimated that the data base 
would normally be apaateasen a weekly basis. This process 
woulg be required to enter data for new facilities and update 
information on existing facilities. In addition, it is assumed 
that there would be approximately 2 report production runs 
per week. Each File Maintenance run will require approximately 
1 minute CPU time at a cost of $22 per run. Bach report pro- 


duction run will require approximately .5 minute CPU time at 


a cost of $11 per run. Computer usage costs will be billed to 


OpP. The cost for data extraction and terminal entry will 


@epend upon the amount of activity associated with introduction 
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cw secure facilities and the number of surveys/inspections 


performed by the various Coane ona offices. Terminal hook-up 
time for one of a new facility will be in the range of 5 to 
lO minutes. Hook-up time for entering new data on an existing 
facility will depend upon the amount of data being added. This 
Should not exceed more than 5 minutes per facility. 

23, zz The pages which follow provide an estimate for 
the various costs seeaciaiea with STORFAC development. Figure 
8 presents the estimate for programmer effort associated with 
software daveroonere which would be charged to the Opp budget. 
Figure 9 provides an estimate of the machine costs for software 
and data base development activities which would be charged to 
the ODP budget. Figure 10 is an estimate of the number of 
work days which would be required to extract and enter the 
data via a terminal using a CAMEXEC menu. Figure 1l is a 
schedule for STORFAC development in terms of calendar weeks 


per task. 
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Software Development Cost Estimates 


CAMEXEC MENU W/EDITS 22 work days 
NIPS FILE ANALYSIS & DESIGN 10 " u 
FILE MAINTENANCE LOGIC | L5 n " 
(Design, Code, Test) 
SSC DESIGNED REPORTS (6) is." " 
AUDIT TRAIL REPORT | 2 u " 
DUPLICATION OF CAMEXEC MENU REPORT 2 " i 
CROSS INDEX REPORT 1 " " 
FILE GENERATION & TEST 5 " " 
NIPS SOFTWARE DOCUMENTATION 10 no m 
USER TRAINING & MONITORING 5 ' . 
COVERS ION TABLES > 4 " 
TOTAL 69 work days 


Note: This translates into approximately $10,800 
@ $600 per work week. 


(18 wk x $600 = $10,800) 


Figure 8. Pregrammer Software Development Cost Estimates 
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MACHINE COST ESTIMATES 


SOFTWARE DEVELOPMENT COMPUTER COST 
(approx. 1 hour CPU time) 


SOFTWARE DEVELOPMENT TERMINAL HOOK-UP COST 
(approx. 200 hours @ $12 hour) 


COMPUTER COST FOR FILE GENERATION & 
REPORT PRODUCTION DURING INCREMENTAL 
DEVELOPMENT 

(approx. .5 hour CPU time) 


TERMINAL HOOK-UP TIME FOR SSC DATA ENTRY 
DURING INCREMENTAL DEVELOPMENT 

(75 facilities per day = 320 

hours at $12 per hook-up hour) 


TOTAL MACHINE COST 


Figure 9. Machine Cost Estimates 
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TER RMS. » OF WORK ING > DAYS 


SSC ORIGINAL DATA EXTRACTION & 20-25 person work days 

CAMEXEC ENTRY TIME 

OL DATA EXTRACTION 20-30 oT. " 

PSD DATA EXTRACTION 20-30 =" vs " 

TSD DATA’ EXTRACTION LO-15 nw " 

ISSG DATA EXTRACTION 10-15 - " " 
25X1A oc/csp DATA EXTRACTION 0-15 t " 

SSC CAMEXEC ENTRY OF NEW 20-25 " " ” 


FACILITIES & ADDITIONAL DATA 


A yee epee ge 


TOTAL 110-155 person work days 


Note: If records must be researched in other offices, the 
data extraction work day costs must be increased 
“proportionately. 


Figure 10. Data Extraction Cost Estimates 
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